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(U//FOUO) Forwarding Selected 
MAILORDER Files Read Me 



(U//FOUO) This document explains how to configure an XKS cluster to forward selected sessions via 
MAILORDER. Sessions are still scanned, tagged, and queryable in XKEYSCORE, even if the quota limit 
(category throttling) has been exceeded for the day. Use this document to learn the procedures for 
switching all Digital Network Intelligence (DNI) filtering and selection to the XKEYSCORE collection 
system. 



(U//FOUO) Configuring DNI Selection in xks.config 

(U//FOUO) Follow these steps to configure xks.config to use the XKS collection system for DNI filtering 
and selection: 

1. (U//FOUO) Logon as the user oper. 

2. (U//FOUO) At the command line from within any directory, type viconf ig and then press 

Enter. The xks.config file will open. 

3. (U//FOUO) In the inputs section of xks.config set the following configurations: 

a. forward_sessions = yes : This enables session forwarding on the 
selected output plugin. You can verify that session forwarding is set to yes in the 
defauit.xmi file located in $XSCORE_DIR/conf ig/plugins . 

Note: Only after running the xks setup plugins process r described on page 2, will 
you see the seiected_ output plugin enabled in defauit.xmi. 

b. category throttle = true (default) . This sets the maximum number of 
sessions per category to 10,000 and the total size forwarded for any given category to be no 
greater than 1GB. If either of these limits is reached, XKEYSCORE will no longer forward 
sessions that hit on that particular category for the rest of the day. It will, however, 
continue to process data for other categories. These limits are reset every 24 hours. 

c. All MAILORDER files will be stored on the Master server in: 

/ex port/d at a/xke y sc ore/ou t pu ts/m a i I ord er 
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You can check the status of the category throttle using one of the following commands: 

« mysqls quota_status_current 

The quota limits forwarding status for all categories. 

* mysqls quota status yesterday 

The quota 1 imits forwarding status for the previous day. 

* mysqls quota_throttled_current 

The top 20 categories for the current day (The phrase "negative remaining" 
indicates the category was throttled). 

d. outputlo cation = master : All MAILORDER files will be generated in: 

/xks d at a/<m a ste r H os tn a m e >/ou tpu ts/m a i I or d e r_ work i ng 

Then the mailorder proc process on the Master will rename and move them to: 

/xks_d ata/<ma sterHostname>/outputs/ma il order 

e. mailorder = yes (default) : On the Master, this creates the 
mailorder proc process that polls the mailorder working directory and then 
moves/renames any MAILORDER files to $XSC ORE_DATA_DIR/ou tpu ts /mailorder . 

4. (U//FOUO) Type :wqi and then press Enter to save and exit xks.config. 



(U//FOUO) Additional Processes 

(U//FOUO) In addition to editing the configurations in xks.config , it is important to run several set-up 
processes. 

1. (U//FOUO) As the oper user, at the command prompt, type xks setup plugins and press 
Enter. This ensures any applicable changes to plugin configurations will take effect. 

2. (U//FOUO) As the oper user, at the command prompt, type xks setup processes and 
press Enter. This will create the mailorder proc process on the Master. 

3. (U//FOUO) At the command prompt, type rsync push config and press Enter. This 
pushes the latest configuration changes to the slaves. 

4. (U//FOUO) As the oper user, at the command prompt, type xks proc start and press 
Enter . This will ensure all of the running processes pick up any configuration changes. 

5. (U//FOUO) At the command prompt, type xks proc saferes tart and press Enter. After 
setup is complete, this restarts process datas for the new configurations to take effect. 
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